​
Alert

An alert is an event that is triggered when something bad happens or going to happen. The term “alert” can sometimes be interchanged with “alarm” (e.g. in CloudWatch) or “monitor” (Datadog).

​
Incident

An incident is a group of alerts that are related to each other.

​
Provider

A provider can be a module that pulls alerts into Keep or pushes data out of keep by interacting with external systems.

​
Provider as a data source

Within the context of a Workflow, a Provider can:
  • Query data - query Datadog’s API or run a SQL query against a database.
  • Push data - send a Slack message or create a PagerDuty incident.

​
Provider as an alert source

When you connect a Provider, Keep begins to read and process alerts from that Provider. For example, after connecting your Prometheus instance, you’ll start seeing your Prometheus alerts in Keep. A Provider can either push alerts into Keep, or Keep can pull alerts from the Provider.

​
Push alerts to Keep (Manual)

You can configure your alert source to push alerts into Keep. For example, consider Prometheus. If you want to push alerts from Prometheus to Keep, you’ll need to configure Prometheus Alertmanager to send the alerts to ‘https://api.keephq.dev/alerts/event/prometheus’ using API key authentication. Each Provider implements Push mechanism and is documented under the specific Provider page.

​
Push alerts to Keep (Automatic)

In compatible tools, Keep can automatically integrate with the alerting policy of the source tool and add itself as an alert destination. You can learn more about Webhook Integration here. Please note that this will slightly modify your monitors/notification policy.

​
Pull alerts by Keep

Keep also integrates with the alert APIs of various tools and can automatically pull alerts. While pulling is easier to set up (requiring only credentials), pushing is preferable when automation is involved.

​
Workflow

Workflows consist of a list of Steps and Actions. A workflow can be triggered in the following ways:
  • When an Alert is triggered.
  • In a predefined interval.
  • Manually.
Workflows are commonly used to:
  1. Enrich your alerts with more context.
  2. Automate the response to alert.
  3. Create multi-step alerts.

​
API first

Keep is an API-first platform, meaning that anything you can do via the UI can also be accomplished through the API This gives you the flexibility to integrate Keep with your existing stack and to automate alert remediation and enrichment processes.